Method and apparatus for authentication of an integrated access and backhaul (IAB) node in a wireless network

Abstract

Accordingly, an embodiment of the present invention provides a method for authenticating an IAB node by an IAB host node in a wireless network. The method includes obtaining IAB authorization information of the IAB node from one of an access and mobility management function (AMF) and a mobility management entity (MME) of the wireless network, determining whether the IAB authorization information of the IAB node indicates that the IAB node is authorized, and assigning a unique identifier / parameter to the IAB node during an IAB-mobile terminal (MT) establishment and / or a backhaul radio link control (RLC) channel establishment and / or a routing update phase. In addition, the method includes storing a unique identifier / parameter in a user equipment (UE) context, the unique identifier / parameter being used to identify the UE context during a distribution unit (DU) partial establishment for authorization check and / or authentication.

Description

Technical Field

[0001] The present invention relates to a wireless communication system, and more particularly, to a method for authenticating an Integrated Access and Backhaul (IAB) node in a wireless network. Background Art

[0002] In order to meet the demand for increased wireless data traffic since the deployment of the fourth generation (4G) communication system, efforts have been made to develop improved fifth generation (5G) or pre-5G communication systems. 5G or pre-5G communication systems are also referred to as "super 4G networks" or "post-long term evolution (LTE) systems". 5G communication systems are considered to be implemented in higher frequency (millimeter wave (mmWave)) bands (e.g., 60 gigahertz (GHz) bands) in order to achieve higher data rates. In order to reduce the propagation loss of radio waves and increase the transmission distance, beamforming, massive multiple input multiple output (MIMO), full-dimensional MIMO (FD-MIMO), array antennas, analog beamforming, and massive antenna technology are discussed for 5G communication systems. In addition, in 5G communication systems, system network improvements are being developed based on advanced small cells, cloud radio access networks (RANs), ultra-dense networks, device-to-device (D2D) communications, wireless backhaul, mobile networks, collaborative communications, coordinated multi-point (CoMP), receiving-end interference elimination, etc. In 5G systems, hybrid frequency shift keying (FSK) and Feher quadrature amplitude modulation (FQAM) and sliding window superposition coding (SWSC) have been developed as advanced coded modulation (ACM), and filter bank multi-carrier (FBMC), non-orthogonal multiple access (NOMA) and sparse code multiple access (SCMA) as advanced access technologies.

[0003] The Internet, which is a human-centered connected network in which humans generate and consume information, is now developing toward the Internet of Things (IoT) in which distributed entities (such as things) exchange and process information without human intervention. The Internet of Everything (IoE) as a combination of IoT technology and big data processing technology through connection with a cloud server has emerged. With technological elements such as a technological connected network in which humans generate and consume information, which is now developing toward the Internet of Things (IoT) in which a cloud server has IoT implementation, sensor networks, machine-to-machine (M2M) communication, machine type communication (MTC), etc. have recently been studied. Such an IoT environment can provide intelligent Internet technology services to create new value for human life by collecting and analyzing data generated between connected things. IoT can be applied to various fields including smart homes, smart buildings, smart cities, smart cars or connected cars, smart grids, healthcare, smart appliances, and advanced medical services through the fusion and combination of existing information technology (IT) and various industrial applications.

[0004] In line with this, various attempts have been made to apply 5G communication systems to IoT networks. For example, technologies such as sensor networks, MTC, and M2M communications can be implemented through beamforming, MIMO, and array antennas. Cloud RAN as an application of the above-mentioned big data processing technology can also be considered an example of the fusion of 5G technology and IoT technology. Summary of the invention

[0005] Solution to the problem

[0006] A primary object of the embodiments herein is to provide a method for authentication of an Integrated Access and Backhaul (IAB) node in a wireless network.

[0007] Another object of the embodiments of the present invention is to use a unique identifier / parameter of the IAB node allocated during the IAB-MT setup and / or backhaul RLC channel establishment and / or routing update phase, wherein the unique identifier / parameter is stored in the UE context, and the stored unique identifier / parameter of the UE is used to identify the UE context during the IAB-DU establishment for authorization check and / or authentication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, wherein like reference numerals represent like parts:

[0009] Figure 1A-Figure 1C An integrated access backhaul (IAB) architecture according to some embodiments is shown;

[0010] Figure 2 A high-level flow of standalone (SA) based IAB integration according to some embodiments is shown;

[0011] Figure 3A A block diagram of an IAB-donor node for authentication of an IAB node in a wireless network according to an embodiment disclosed herein is shown;

[0012] Figure 3B A block diagram of an IAB node establishing / setting up an F1* interface with an IAB host node in a wireless network according to an embodiment disclosed herein is shown;

[0013] Figure 4 A sequence diagram showing the use of an IAB node DU IP address to determine the context of an IAB node to establish / set up an F1* interface with an IAB host node according to an embodiment disclosed herein;

[0014] Figure 5 A sequence diagram showing the use of the C-RNTI of the IAB node MT function to determine the context of the IAB node to establish / set up the F1* interface with the IAB host node according to the embodiments disclosed herein;

[0015] Figure 6 A sequence diagram showing the use of the GUTI of the IAB node MT function to determine the context of the IAB node to establish / set up the F1* interface with the IAB host node according to an embodiment disclosed herein;

[0016] Figure 7 A sequence diagram showing the use of an IAB Node-DU ID to determine the context of an IAB Node to establish / set up an F1* interface with an IAB Host Node according to an embodiment disclosed herein; and

[0017] Figure 8 A sequence diagram is shown of using an IAB node context ID to determine the context of an IAB node to establish / set up an F1* interface with an IAB host node according to an embodiment disclosed herein. DETAILED DESCRIPTION

[0018] Accordingly, an embodiment of the present invention provides a method for authenticating an integrated access and backhaul (IAB) node in a wireless network. The method includes: obtaining, by an IAB host node, IAB authorization information of the IAB node from one of an access and mobility management function (AMF) and a mobility management entity (MME) of the wireless network; determining, by the IAB host node, that the IAB authorization information of the IAB node indicates that the IAB node is authorized; in response to a reception request from the IAB node, allocating, by the IAB host node, at least one Internet Protocol (IP) address to a distributed unit (DU) of the IAB node; storing, by the IAB host node, the at least one allocated IP address of the DU of the IAB node in context information of the IAB node; receiving, by the IAB host node, an F1 establishment message and the at least one allocated IP address from the IAB node to initiate an F1 connection between the IAB node and the IAB host node; and identifying, by the IAB host node, the context information of the IAB node using the at least one allocated IP address.

[0019] In an embodiment, the method further includes: generating, by the IAB host node, security parameters using the identified context information to perform authentication of the IAB node; and establishing, by the IAB host node, an Internet Protocol Security (IPsec) connection with the IAB node after successful authentication based on the security parameters generated from the identified context information.

[0020] In an embodiment, the method includes: performing, by an IAB node, authentication with a core network and establishing an AS security context with an IAB host node, wherein the IAB node acts as a user equipment (UE), wherein the core network includes one of an AMF and an MME of a wireless network; authorizing, by the core network, the IAB node through a subscription profile of the IAB node during a registration process of the IAB node; and sending, by the core network, IAB authorization information to the IAB host node.

[0021] In an embodiment, establishing an AS security context with the IAB host node includes using context information provided by one of a normal gNodeB (gNB) or an eNodeB (eNB) as part of one of a handover procedure, an initial attach procedure, or a secondary gNB (SgNB) addition procedure.

[0022] In an embodiment, the IAB host node obtains the IAB authorization information of the IAB node from one of the AMF and the MME during a part of the initial context setup process.

[0023] In an embodiment, the F1 connection is initiated by the DU function of the IAB node.

[0024] In an embodiment, at least one IP address is assigned to the DU of the IAB node by at least one of an operations, administration and management (OAM) server, a Central Unit (CU) of the IAB host node, and a DU of the IAB host node.

[0025] Accordingly, an embodiment of the present invention provides an IAB host node for authentication of an integrated access and backhaul (IAB) node in a wireless network. The IAB host node includes: a memory, a processor coupled to the memory, and an authentication controller coupled to the processor, the authentication controller being configured to: obtain IAB authorization information of the IAB node from one of an access and mobility management function (AMF) and a mobility management entity (MME) of the wireless network; determine that the IAB authorization information of the IAB node indicates that the IAB node is authorized; in response to determining that the IAB node is authorized, assign at least one Internet Protocol (IP) address to a distribution unit (DU) of the IAB node; store the assigned at least one IP address of the DU of the IAB node in the context information of the IAB node; send at least one IP address of the DU of the IAB node to the IAB node; receive an F1 setup message and the assigned at least one IP address from the IAB node to initiate an F1 connection between the IAB node and the IAB host node; and use the assigned at least one IP address to identify the context information of the IAB node.

[0026] In an embodiment, the IAB host node further includes: generating, by the IAB host node, security parameters using the identified context information to perform authentication of the IAB node; and establishing, by the IAB host node, an Internet Protocol Security (IPsec) connection with the IAB node after successful authentication based on the security parameters generated from the identified context information.

[0027] In an embodiment, the IAB host node obtains the IAB authorization information of the IAB node from the AMF or MME during a part of the initial context establishment procedure.

[0028] In an embodiment, the F1 connection is initiated by the DU function of the IAB node.

[0029] In an embodiment, at least one IP address is assigned to the DU of the IAB node by at least one of an operations administration and management (OAM) server, a centralized unit (CU) of the IAB host node, and a DU of the IAB host node.

[0030] Accordingly, embodiments herein provide a method for authentication of an Integrated Access and Backhaul (IAB) node in a wireless network. The method includes: obtaining, by an IAB host node, IAB authorization information of the IAB node from one of an access and mobility management function (AMF) and a mobility management entity (MME) of a wireless network; determining, by the IAB host node, that the IAB authorization information of the IAB node indicates that the IAB node is authorized; receiving, by the IAB host node, at least one Internet Protocol (IP) address from the IAB node, wherein the at least one IP address received from the IAB node is allocated by an operation operation and management (OAM) server; storing, by the IAB host node, at least one IP address of a DU of the IAB node in context information of the IAB node; receiving, by the IAB host node, an F1 establishment message and the allocated at least one IP address from the IAB node to initiate an F1 connection between the IAB node and the IAB host node; identifying, by the IAB host node, the context information of the IAB node using the allocated at least one IP address; generating, by the IAB host node, security parameters using the identified context information to perform authentication of the IAB node; and establishing, by the IAB host node, an Internet Protocol security (IPsec) connection with the IAB node after successful authentication based on the security parameters generated from the identified context information.

[0031] Accordingly, an embodiment of the present invention provides a method for authentication of an integrated access and backhaul (IAB) node in a wireless network. The method includes: receiving, by the IAB host node, an F1 establishment message and at least one Internet Protocol (IP) address from an IAB node to initiate an F1 connection between the IAB node and the IAB host node; identifying, by the IAB host node, context information of the IAB node using at least one IP address; generating, by the IAB host node, security parameters using the identified context information to perform authentication of the IAB node; and establishing, by the IAB host node, an Internet Protocol security (IPsec) connection with the IAB node after successful authentication based on the security parameters generated from the identified context information.

[0032] In an embodiment, identifying, by the IAB host node, context information of the IAB node using at least one IP address includes: obtaining, by the IAB host node, IAB authorization information of the IAB node from one of an access and mobility management function (AMF) and a mobility management entity (MME) of the wireless network; determining, by the IAB host node, that the IAB authorization information of the IAB node indicates that the IAB node is authorized; allocating, by the IAB host node, at least one IP address to a distribution unit (DU) of the IAB node in response to receiving a request from the IAB node; and storing, by the IAB host node, the allocated at least one IP address of the DU of the IAB node in the context information of the IAB node.

[0033] When considered in conjunction with the following description and the accompanying drawings, these and other aspects of the embodiments herein will be better appreciated and understood. However, it should be understood that the following description, although indicating preferred embodiments and many specific details thereof, is provided in an illustrative and non-limiting manner. Without departing from the spirit of the invention, many changes and modifications may be made within the scope of the embodiments herein, and the embodiments herein include all of these modifications.

[0034] Before proceeding to the following detailed description, it may be helpful to set forth definitions of certain words and phrases used throughout this patent document: the terms "include" and "comprising" and their derivatives mean inclusion rather than limitation; the term "or" is inclusive, meaning and / or; the phrases "associated with" and "associated with" and their derivatives may mean including, included within, interconnected with, containing, contained within, connected to or connected with, coupled to or coupled with, communicable with, cooperating with, interleaved, juxtaposed, proximate, bound to or bound with, having, having a property of, and the like; and the term "controller" means any device, system, or portion thereof that controls at least one operation, such device may be implemented in hardware, firmware, or software, or some combination of at least two thereof. It should be noted that the functionality associated with any particular controller may be centralized or distributed, whether locally or remotely.

[0035] In addition, the various functions described below can be implemented or supported by one or more computer programs, each of which is formed by a computer-readable program code and embodied in a computer-readable medium. The terms "application" and "program" refer to one or more computer programs, software components, instruction sets, processes, functions, objects, classes, instances, related data or parts thereof suitable for implementation in a suitable computer-readable program code. The phrase "computer-readable program code" includes any type of computer code, including source code, object code and executable code. The phrase "computer-readable medium" includes any type of medium that can be accessed by a computer, such as a read-only memory (ROM), a random access memory (RAM), a hard drive, a compact disk (CD), a digital video disk (DVD) or any other type of memory. "Non-transitory" computer-readable media does not include wired, wireless, optical or other communication links that transmit temporary electrical signals or other signals. Non-transitory computer-readable media include media that can permanently store data and media that can store data and rewrite it later, such as rewritable optical disks or erasable memory devices.

[0036] Definitions for certain words and phrases are provided throughout this patent document, those of ordinary skill in the art should understand that in many, if not most instances, such definitions apply to prior, as well as future uses of such defined words and phrases.

[0037] Invention Mode

[0038] Discussed below Figures 1A to 8 The various embodiments used to describe the principles of the present disclosure in this patent document are merely exemplary and should not be interpreted in any way as limiting the scope of the present disclosure. Those skilled in the art will appreciate that the principles of the present disclosure can be implemented in any appropriately arranged system or device.

[0039] The embodiments of the present invention and their various features and advantageous details are explained more fully with reference to the non-limiting embodiments shown in the accompanying drawings and described in detail in the following description. The description of known components and processing techniques is omitted so as not to unnecessarily obscure the embodiments of the present invention. In addition, the various embodiments described herein are not necessarily mutually exclusive, because some embodiments can be combined with one or more other embodiments to form new embodiments. Unless otherwise stated, the term "or" used herein refers to non-exclusive or. The examples used herein are merely to facilitate understanding of the ways in which the embodiments of the present invention can be practiced, and further enable those skilled in the art to practice the embodiments of the present invention. Therefore, these examples should not be interpreted as limiting the scope of the embodiments of the present invention.

[0040] As is conventional in the art, embodiments may be described and illustrated in terms of blocks that perform one or more functions described. These blocks (which may be referred to herein as managers, units, modules, hardware components, etc.) are physically implemented by analog and / or digital circuits (such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hard-wired circuits, etc.), and may optionally be driven by firmware and software. For example, the circuit may be embodied in one or more semiconductor chips, or on a substrate support such as a printed circuit board. The circuits that make up the blocks may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuits), or by a combination of dedicated hardware that performs some functions of the blocks and a processor that performs other functions of the blocks. Without departing from the scope of the present disclosure, each block of the embodiment may be physically divided into two or more interacting and separate blocks. Similarly, without departing from the scope of the present disclosure, the blocks of the embodiment may be physically combined into more complex blocks.

[0041] Throughout this disclosure, the terms "F1*" and "F1" are used interchangeably and represent an NR backhaul link (an NR link for backhaul (which may be wireless) between an IAB node to an IAB host and between IAB nodes in the case of a multi-hop network). Further, F1* refers to F1*-C and / or F1*-U. The IAB authorization information indicates at least one of authorized, unauthorized. When considering a dual-connectivity architecture, the term "K gNB ” also refers to “SK gNB ” or “K SN " and are used interchangeably in this document. In addition, when the IAB node is connected to 5GC or gNB or eNB, the term "base station (300)" may also be an "IAB host node". The terms "IAB host device" or "IAB host node" or "IAB host gNB" have the same meaning and are used interchangeably throughout the document. In addition, the terms "MT function", "IAB node MT", "IAB node UE", "IAB-MT", "IAB-UE" and "IAB-UE function" in the IAB node are the same and are used interchangeably throughout the document. The term "IP address" may be an "IP version 4 (IPv4)" or "IP version 6 (IPv6)" address. In addition, the network entity includes an AMF (Access and Mobility Management Function) and an MME (Mobility Management Entity).

[0042] The 3rd Generation Partnership Project (3GPP) has decided to support wireless backhaul / relay in New Radio (NR). To enable faster fifth generation (5G) network deployment scenarios, support for wireless backhaul and relay links is required because the wireless links support flexible and dense deployment of NR cells without the need to proportionally increase the density of the transmission network. 3GPP prefers to follow a centralized unit (CU) / distributed unit (DU) architecture, where the integrated access backhaul (IAB) node provides DU functionality and mobile terminal (MT) functionality, and actually looks like a DU connected to the controlling CU through a wireless interface. Therefore, the wireless interface between the IAB node and the IAB host node is an F1* interface / F1 connection, similar to the F1 interface connecting the CU and the DU.

[0043] Furthermore, the F1* interface will have to exchange packets over a wireless interface, as opposed to a traditional F1 interface where F1 packets are exchanged over a wired network (hence throughout this document, F1* is often referred to as F1, regardless of the access medium (air / wired)). Exchanging packets over a wireless interface creates new potential security risks for IAB deployments.

[0044] Phase 1 and / or Phase 2 of the IAB node integration process: The IAB node acts as a user equipment (UE) with MT function, performs authentication, authorization, and establishes an access stratum (AS) security context with the IAB host node. During the above process (i.e., IAB-MT establishment), the IAB host node obtains the IAB authorization information of the IAB node from the AMF / MME (e.g., as part of the initial context establishment process (i.e., INITIAL CONTEXT SETUP REQUEST) message) and stores the authorization information of the IAB node and the context of the IAB node (i.e., UE context). Then during the establishment of the IAB-DU part, the IAB host node checks whether the IAB-MT part is authorized. If authorized, the IAB host node continues with the IAB-DU part establishment (i.e., Phase 3).

[0045] In addition, during the IAB-DU part establishment, at least one of the following is used as a unique parameter to identify the established UE context of the IAB node (thereby identifying the authorization information and authentication parameters): Cell Radio Network Temporary Identifier (C-RNTI) (assigned to the IAB node acting as a UE with MT function), Internet Protocol (IP) address assigned to the IAB node (during the backhaul Radio Link Control (RLC) channel establishment and / or routing update phase), Globally Unique Temporary ID (GUTI) (assigned by the core network), AS identity (IAB node-DU ID (gNB-DU ID)), recovery ID, Inactive Radio Network Temporary Identifier (I-RNTI), etc. The unique identification / parameter assigned to the IAB node during the IAB-MT establishment and / or backhaul RLC channel establishment and / or routing update phase is stored in the UE context for identifying the context for authorization check and / or authentication during the IAB-DU part establishment.

[0046] It is necessary to store unique parameters during the Phase 1 and / or Phase 2 process in order to identify the IAB node context (UE context) to perform authentication and / or determine whether the IAB node is "authorized" or "unauthorized" during Phase 3 (IAB-DU partial establishment). Therefore, a system and method are needed to identify the established UE context and check whether the IAB node is authorized (e.g., "IAB authorized") and / or generate security certificates / parameters required to perform the authentication process to establish the F1* interface. In addition, the authentication mechanism for establishing an Internet Protocol Security (IPsec) tunnel through Internet Key Exchange (IKEv2) (using a dynamic pre-shared key (PSK)) needs to identify the AS security context established by the IAB-UE to generate a dynamic PSK and use it to perform authentication to establish an IPsec Security Association (SA) for the F1 interface. In order for the IAB host to identify the context of the established IAB node (UE context) during the IAB-DU part establishment to perform authorization and / or authentication of the IAB node, the IP address allocated during Phase 2 is used to identify the UE context and establish a security association for the F1 interface.

[0047] The unique identification / parameter (IP address of the IAB node DU) assigned to the IAB node during the IAB-MT establishment and / or backhaul RLC channel establishment and / or routing update phase is used to identify the context for authorization check and / or authentication during the IAB-DU part establishment. In some designs, the 3GPP AS security context is identified using an MT-specific identifier (e.g., C-RNTI). The AS security context is never identified using other identifiers (such as GUTI) or using a DU-specific identifier (such as DU IP address). The AS security context is identified by the gNB / (M)eNB / IAB host for establishment of a Packet Data Convergence Protocol (PDCP) instance to protect the Signaling Radio Bearers (SRBs) and Data Radio Bearers (DRBs).

[0048] In addition, if an IPsec Security Gateway (SEG) is used (F1 interface IPsec can be terminated at the SEG before the IAB host CU), the SEG cannot understand DU specific parameters (such as the Backhaul Adaptation Protocol (BAP) address) to process the IAB / DU specific parameters and request the IAB host CU to perform security context retrieval to establish IPsec. Therefore, in contrast, it would be effective to use the IAB node DU IP address to identify the 3GPP AS security context for the DU to establish the security process (authentication and / or authorization). In addition, the authentication mechanism for establishing an IPsec tunnel through IKEv2 is performed to protect F1 traffic at the IP layer, and it is more reasonable to use the IP layer parameter of the DU's IP address to identify the security context than to use other parameters (such as the BAP address). Since the BAP address is not an authenticated identifier (no verification of the authenticity of the BAP address is performed), this means that a malicious IAB node with a valid BAP address can establish an IPsecSA for a fake IP address, resulting in the redirection of victim packets to the malicious IAB node.

[0049] Figure 1A-Figure 1C An IAB architecture according to some embodiments is shown. Therefore, 3GPP decided to study the security aspects of the IAB architecture and the protection of the related wireless backhaul links.

[0050] The IAB host node (100) is a gNodeB (gNB) that provides the function of NR backhaul supporting the IAB node (200a-200e). In other words, the IAB host node (100) is a gNB that provides network access to the UE via the backhaul and access link network. The IAB node (e.g., 100, 200a-200e) is a radio access network (RAN) node that provides the function of supporting the user equipment (UE) (200f-200h) to connect to the network (300-400) via the NR backhaul. In other words, a RAN node that supports the NR access link to the UE and the NR backhaul link to the parent node and the child node. The NR backhaul link is an NR link for backhaul between the IAB node (200a-200e) to the IAB host node (100) and between the IAB nodes (200a-200e) in the case of a multi-hop network.

[0051] The IAB nodes (200a-200b) terminate the gNB-DU portion of the F1-C and F1-U interfaces. The gNB-DU functionality of the IAB nodes, together with the gNB-CU on the IAB host node (100), provides NR access to UEs (200f-200h) and child IAB nodes (200a-200e) in the southbound direction. The IAB nodes also terminate a subset of the NR-Uu radio interface (i.e., the mobile terminology (MT) portion) to access the network in the northbound direction. The IAB nodes (200a-200e) can access the network using either NR standalone (SA) mode or NR non-standalone (NSA) mode (i.e., EN-DC). In NSA mode, the IAB node is also connected to the MeNB (i.e., MeNB, indicating that it is a 'master' (M) base station controlling a 'secondary' (S) 5G NR base station) via Long Term Evolution (LTE), and the IAB host node (100) terminates X2-C as an SgNB, as Figure 1B-Figure 1C shown.

[0052] The IAB nodes (200a-200e) terminate IP transport and are reachable from the operator's transport network via the DU portion of the IAB host node (100). The IAB nodes (200a-200e) and the CUs (i.e., CU-CP and CU-UP) of the host gNB communicate with each other using IP as if they were CU / DU transport connections on a wired network. In the downlink, the IAB host DU performs mapping of IP packets destined for the IAB nodes (200a-200e) to southbound NR return RLC channels, while in the uplink, the IAB nodes (200a-200e) perform mapping of IP packets destined for the operator's transport network to northbound RLC channels. The IAB Adaptation Layer (IAL) protocol, which resides above the Radio Link Control (RLC) layer, is used at the DU portion of the IAB nodes (200a-200e) and the IAB host node (100) to support forwarding across the IAB network. In case of multi-hop deployment, packet forwarding in the intermediate IAB nodes (200a-200e) is done based on the information carried in the IAL protocol and the configuration received from the gNB-CU function of the host gNB which establishes the mapping / forwarding rules / tables. On the wireless backhaul interface, the CU-CP of the IAB host node (100) will establish one or more backhaul (BH) RLC channels.

[0053] refer to Figure 1C, the portion of the IAB node (200a-200e) that supports the Uu interface toward the IAB host node (100) or another parent IAB node is called an IAB-UE (or IAB-MT). The backhaul connection between the IAB node (200b and 200d) or the IAB host node (100) or another parent IAB node (e.g., 200b is the parent IAB node of the 200d IAB node) and the Public Land Mobile Network (PLMN) is managed through the Uu interface. The DU (or gNB-DU) function in the IAB node (e.g., 100, 200b, and 200d) is responsible for providing NR Uu access to the UE (200f-200I) and the child IAB node (e.g., 200d). The corresponding gNB-CU function resides on the IAB host gNB, which controls the IAB node gNB-DU via the F1 interface. The IAB nodes (100, 200b and 200d) appear as normal gNBs to UEs (200f-200I) and other IAB nodes, and allow them to connect to the 5GC. The DU function of the IAB nodes (100, 200b and 200d) allows UEs (200f-200I) to connect to the IAB nodes. The DU function of the IAB node (200b), together with the CU function on the IAB host node (100), provides access to the core network in the southbound direction to the child IAB node (200d) and the UE (200c-200e). The IAB nodes (200a-200e) are connected to the IAB host node (100) or the parent IAB node using the MT function via the NR Uu interface. The IAB nodes receive data from the core network using the DU function of the IAB nodes (200a-200b) via the NR backhaul link. The Uu backhaul link may exist between the IAB node (200a-200b) and a gNB or another IAB node (200a-200b) referred to as an IAB host node (100).

[0054] Figure 2 A high-level flow of SA-based IAB integration according to some embodiments is shown. SA-based IAB integration includes an IAB host node (100), an IAB node-1 (200b), an IAB node-2 (200d), and a 5G core (5GC) (300-400) (e.g., network, core network) in a wireless network (1000).

[0055] At 202, stage 1: IAB-MT establishment process, where the MT function of the new IAB node (e.g., IAB node-2) (200d) connects to the network as a normal UE by performing the following operations: Radio Resource Control (RRC) connection establishment process with the IAB host CU, authentication with the core network (300-400), context management related to the IAB node-2 (200d), radio bearer configuration related to the access traffic of the IAB node-2 (200d) at the radio access network (RAN) side, and optionally, Operation Operation and Management (OAM) connection establishment. As part of the IAB-MT establishment process, the IAB-MT node obtains the following parameters:

[0056] a) C-RNTI, which is allocated as part of the RRC connection establishment process, is provided by the IAB host CU / eNB through RRC signaling messages, and C-RNTI is actually allocated by the IAB host DU / eNB for the IAB node. C-RNTI is a unique identifier used to identify the RRC connection between the UE and the gNB / eNB and is also used for scheduling, which is dedicated to a specific UE.

[0057] b) GUTI, which is a core network temporary identifier, is allocated by the MME / AMF as part of the registration process and provided to the IAB node by the MME / AMF (via the IAB host / eNB) through NAS signaling messages. The GUTI is used between the UE and the MME / AMF to identify the UE at the NAS layer.

[0058] c) Protocol Data Unit (PDU) Session IP Address / Packet Data Network (PDN) Connection IP Address, if the UE establishes a user plane connection, for example with an OAM server. The SMF is responsible for session management and allocates an IP address to the UE during the PDU session establishment process, and the MME is responsible for the PDN connection. The IP address of the UE's PDU / PDN session is maintained regardless of the UE's location so that session continuity is maintained. The PDU Session IP Address is used for IP layer routing between the UE and external networks via user plane functions / gateways. The gNB / eNB uses the PDU Session IP Address as a QoS filter parameter to enforce QoS for the PDU Session. The PDU Session IP Address is never used as a UE identification parameter in the Radio Access Network (RAN), and there is no dependency between the PDU Session IP Address of the IAB-UE (Data Network (DN) specific) and the IP Address of the IAB-DU (RAN specific), they are completely independent and are assigned by different entities based on network configuration.

[0059] At 204, Phase 2.1: Backhaul RLC Channel Establishment, wherein a backhaul RLC channel for at least CP traffic, such as carrying F1-C messages to and from IAB nodes (eg, IAB Node-1 (200b), IAB Node-2 (200d)) is established.

[0060] At 206, Phase 2.2: Routing Update Procedure, where the Backhaul Adaptation Protocol (BAP) layer is updated to support routing between the new IAB Node-2 (200d) and the IAB Host DU. This includes configuration of the BAP route identifier for routing in the downstream direction on the IAB Host DU and the BAP route identifier in the upstream direction on the MT function of the IAB Node-2 (200d). The routing table is updated for all ancestor IAB nodes (e.g., IAB Node 1 (200b)) and the IAB Host DU with routing entries for the new BAP route identifier. The DU function of the new IAB Node-2 (200d) is configured with an IP address to establish an IP connection to the operator network. As part of the backhaul RLC channel establishment procedure and the routing update procedure, the IAB Node obtains the following IAB-DU specific parameters via RRC signaling (in normal operation, the UE is not aware of such parameters):

[0061] a) BAP address and BAP routing ID for IAB-DU.

[0062] b) At least one IP address is allocated to the IAB-DU F1 interface by the IAB host or by the OAM server.

[0063] At 208, Phase 3: IAB-DU Establishment Procedure, where the DU function of IAB Node-2 is configured. The DU function of IAB Node-2 (200d) initiates the establishment of F1-C connection with the IAB host CU. After F1 establishment, the IAB node can now start providing services to the UE.

[0064] The IAB-UE needs to be authenticated by the 3GPP network, and the IAB node needs to authenticate the 3GPP network, just like ordinary UE accessing the 3GPP core network as specified in the 3GPP technical specifications. In addition, the network needs to authorize the IAB node to provide services. An unauthorized IAB node with valid subscription credentials can gain access to obtain / provide IAB services. Therefore, the authorization of the IAB node's connection to the 5GC or Evolved Packet System (EPS) should be evaluated by the network. Once the IAB node is successfully identified and authenticated, the authorization of the IAB node's connection to the 5GC / EPS should be evaluated by the network. However, the network needs to authorize and / or authenticate the IAB node twice because the following two processes are independent processes,

[0065] a. During the establishment of a secure RRC connection with the network (IAB-MT establishment), the MT function in the IAB node performs authentication with the network, obtains authorization from the network, and establishes an AS security context for the secure exchange of RRC messages and user plane traffic. The C-RNTI in the RRC layer is used to identify the UE context; and

[0066] b. During the establishment of the secure F1* interface (IAB-DU establishment), the authentication mechanism for establishing the Internet Protocol Security (IPsec) tunnel through IKEv2 needs to be performed. In some designs, based on the authentication method, the policy and authentication data are identified, for example, an identifier in the ID payload in the IKEv2 protocol. In addition, the network should ensure that only authorized IAB nodes establish F1 security contexts for the secure F1* interface.

[0067] When establishing a secure RRC connection (IAB node acts as a UE with MT function), authorization is performed during the IAB node registration process, and the core network (e.g., Unified data management (UDM) via access and mobility management function (AMF) or Home Subscriber Server (HSS) via mobility management entity (MME)) should authorize the IAB node through the subscription profile. However, when establishing a secure F1* interface, a separate authentication mechanism for establishing an IPsec tunnel through IKEv2 needs to be performed, and there is no mechanism defined on how the host gNB (host CU) authorizes and / or authenticates the IAB node to dynamically establish the F1* establishment process (without pre-configuration of credentials). In particular, when performing the phase 3 process (especially dynamically generating security parameters to perform authorization and / or authentication to establish a secure F1* interface), there is no mechanism defined on how to identify the established UE context (established during phase 1).

[0068] In some designs, dynamic PSK calculation for IKEv2 PSK authentication is supported to support flexible plug and play of IAB nodes and IAB hosts without pre-configured (multiple) PSKs. When using dynamic PSK, IAB nodes and IAB hosts SHOULD use K gNB To calculate PSK(K IAB The IAB host needs to identify the AS security context of the IAB node (K gNB ) (created by the MT function) to derive K IAB (used to establish a secure F1 interface). Therefore, when performing the F1 interface establishment (Phase 3), a mechanism is needed to identify the AS security context of the IAB node (established via the NR Uu interface in Phase 1) in the IAB Host.

[0069] Therefore, embodiments of the present invention provide a method for authenticating an IAB node by an IAB host node in a wireless network. The method includes obtaining IAB authorization information of the IAB node from an access and mobility management function (AMF) or a mobility management entity (MME) of the wireless network, determining whether the IAB authorization information of the IAB node (200) indicates that the IAB node is authorized, and assigning a unique identifier / parameter to the IAB node during an IAB-MT establishment and / or a backhaul RLC channel establishment and / or a routing update phase. In addition, the method includes storing the unique identifier / parameter in a UE context, the unique identifier / parameter being used to identify the UE context during an IAB-DU partial establishment for authorization check and / or authentication (dynamically generating security parameters by using security parameters established during an IAB-MT establishment and / or a backhaul RLC channel establishment and / or a routing update phase).

[0070] Referring now to the drawings and more particularly to FIG. 3A to FIG. 8 , wherein like reference numerals indicate corresponding features consistently throughout the drawings, there is shown a preferred embodiment.

[0071] Figure 3A FIG. 2 shows an IAB node (200) used in a wireless network (1000) according to an embodiment disclosed herein. Figure 3A 1 is a block diagram of an authenticated IAB host node (100) (not shown). In an embodiment, the IAB host node (100) includes a memory (110), a processor (120), a communicator (130), an authentication controller (140), a centralized unit (CU) function (150), and a distributed unit (DU) function (160). Throughout this disclosure, the terms "CU function (150)", "IAB host CU (150)", and "CU (150)" have the same meaning and can be used interchangeably. Throughout this disclosure, the terms "DU function (160)" and "DU (160)" can be used interchangeably and have the same meaning.

[0072] The memory (110) also stores instructions to be executed by the processor (120). The memory (110) may include a non-volatile storage element. Examples of such non-volatile storage elements may include a magnetic hard disk, an optical disk, a floppy disk, a flash memory, or various forms of electrically programmable memory (EPROM) or electrically erasable programmable (EEPROM) memory. In addition, in some examples, the memory (110) may be considered a non-transitory storage medium. The term "non-transitory" may mean that the storage medium is not embodied in a carrier or propagating signal. However, the term "non-transitory" should not be interpreted as the memory (110) being non-removable. In some examples, the memory (110) may be configured to store a larger amount of information than the memory. In a specific example, the non-transitory storage medium may store data that may change over time (e.g., in a random access memory (RAM) or a cache). In an embodiment, the memory (110) may be an internal storage unit, or the memory may be an external storage unit of the IAB host node (100), a cloud storage device, or any other type of external storage device.

[0073] The processor (120) communicates with the memory (110), the communicator (130), the authentication controller (140), the CU (150), and the DU (160). The processor (120) is configured to execute instructions stored in the memory (110) and perform various processes. The communicator (130) is configured to communicate internally between internal hardware components and with external devices via one or more networks.

[0074] In an embodiment, the authentication controller (140) obtains IAB authorization information of the IAB node (200) from an access and mobility management function (AMF) (300) or a mobility management entity (MME) of the wireless network (1000). In addition, the authentication controller (140) determines whether the IAB authorization information of the IAB node (200) indicates that the IAB node (200) is authorized. In addition, if the IAB node (200) requests, the authentication controller (140) allocates an Internet Protocol (IP) address to a distribution unit (DU) of the IAB node (200) in response to determining that the IAB authorization information of the IAB node (200) indicates that the IAB node (200) is authorized. Alternatively, if the IP address is obtained by other means, the Internet Protocol (IP) address of the distribution unit (DU) of the IAB node (200) is notified to the authentication controller (140) by the IAB node (200). Furthermore, the authentication controller (140) is configured to store the assigned / notified IP address of the DU (250) of the IAB node (200) in the context of the IAB node (200) and the IAB authorization information of the IAB node (200) in the memory (110).

[0075] In addition, if the IAB node (200) requests, the authentication controller (140) sends the IP address of the DU (250) of the IAB node (200) to the IAB node (200). In addition, the authentication controller (140) receives an F1 establishment message and the assigned / notified IP address from the IAB node (200) to initiate an F1* connection between the IAB node (200) and the IAB host node (100). In addition, the authentication controller (140) uses the assigned / notified IP address to identify the context of the IAB node. In addition, the authentication controller (140) can determine whether the IAB authorization information stored in the context of the IAB node (200) is authorized. In addition, the authentication controller (140) establishes an Internet Protocol Security (IPsec) connection with the IAB node (200) in response to determining that the IAB authorization information stored in the context of the IAB node (200) is authorized, and by generating security parameters from the identified context.

[0076] although Figure 3A Various hardware components of the IAB host node (100) are shown, but it should be understood that other embodiments are not limited thereto. In other embodiments, the IAB host node (100) may include fewer or more components. In addition, the labels or names of the components are for illustrative purposes only and do not limit the scope of the present invention. One or more components can be combined together to perform the same or substantially similar functions to authenticate the IAB node (200) in the wireless network (1000).

[0077] Figure 3B A block diagram of an IAB node (200) establishing / setting up an F1* interface with an IAB host node (100) in a wireless network (1000) according to an embodiment disclosed herein is shown. In an embodiment, the IAB node (200) includes a memory (210), a processor (220), a communicator (230), a mobile terminal (MT) function (240), and a DU function (250). Throughout this disclosure, the terms "MT function (240)", "IAB-MT (240)", "UE function (240)", "UE (240)", and "MT (240)" are used interchangeably and have the same meaning. Throughout this disclosure, the terms "DU function (250)", "IAB-DU (250)", and "DU (250)" are used interchangeably.

[0078] The memory (210) also stores instructions to be executed by the processor (220). The memory (210) may include a non-volatile storage element. Examples of such non-volatile storage elements may include a magnetic hard disk, an optical disk, a floppy disk, a flash memory, or various forms of electrically programmable memory (EPROM) or electrically erasable programmable (EEPROM) memory. In addition, in some examples, the memory (210) may be considered a non-transitory storage medium. The term "non-transitory" may mean that the storage medium is not embodied in a carrier or propagating signal. However, the term "non-transitory" should not be interpreted as the memory (210) being non-removable. In some examples, the memory (210) may be configured to store a larger amount of information than the memory. In a specific example, the non-transitory storage medium may store data that may change over time (e.g., in a random access memory (RAM) or a cache). In an embodiment, the memory (210) may be an internal storage unit, or the memory may be an external storage unit of the IAB host node (100), a cloud storage device, or any other type of external storage device.

[0079] The processor (220) communicates with the memory (210), the communicator (230), the UE (240), and the DU (250). The processor (220) is configured to execute instructions stored in the memory (210) and perform various processes. The communicator (230) is configured to communicate internally between internal hardware components and to communicate with external devices via one or more networks.

[0080] In an embodiment, the UE (240) performs authentication with the core network and establishes an AS security context with the IAB host node (100), the AS security context with the IAB host node (100) using a context provided by one of the normal gNodeB (gNB) or eNodeB (eNB) as part of a handover procedure, an initial attach procedure, or a secondary gNB (SgNB) addition procedure. In addition, the DU (250) initiates an F1* connection with the IAB host node (100) by sending an F1 setup message.

[0081] although Figure 3B Various hardware components of the IAB node (200) are shown, but it should be understood that other embodiments are not limited thereto. In other embodiments, the IAB node (200) may include fewer or more components. In addition, the labels or names of the components are for illustrative purposes only and do not limit the scope of the present invention. One or more components can be combined together to perform the same or substantially similar functions, thereby establishing / setting up an F1* interface with the IAB host node (100) in the wireless network (1000).

[0082] Figure 4A sequence diagram is shown for determining the context of the IAB node (200) using the IAB node DU IP address to establish / set up the F1* interface with the IAB host node (100) according to embodiments disclosed herein.

[0083] At 402, as part of the IAB-MT (240) establishment procedure (Phase 1), the IAB node (200) (i.e., acting as a UE with MT functionality (240)) performs authentication and establishes an AS security context with a normal gNB / eNB or an IAB host (100). If registered with a normal gNB / eNB, the IAB node (200) (i.e., acting as a UE with MT functionality (240)) establishes an AS security context with the IAB host (100) using a context provided by the normal gNB / eNB as part of the handover procedure or by performing an Attach / Registration (Initial Attach) procedure or by an SgNB Addition procedure (in which case the normal gNB / eNB is a MgNB / MeNB).

[0084] At 404-406, further as part of the IAB-MT (240) establishment process (Phase 1), once the IAB node (200) is successfully identified and authenticated, the authorization of the IAB node (200) to connect to the 5GC / EPS should be evaluated by the network (e.g., AMF (300), UDM (400)). Authorization is performed during the IAB node registration process. The core network should authorize the IAB node (200) by subscribing to the profile. The IAB host (100) receives the authorization from the AMF (300) / MME ( Figure 4 (not shown) obtains the IAB authorization information of the IAB node (200) (eg, as part of the initial context establishment process (ie, the INITIAL CONTEXT SETUP REQUEST message)).

[0085] At 408, further as part of the IAB-MT (240) establishment process (Phase 1), if the authorization information is indicated as "Authorized", the IAB host (100) stores the authorization information of the IAB node (200) (i.e., received at 406) and the context of the IAB node (i.e., (NG-RAN node) UE context).

[0086] At 410, as part of the phase 2 process, at least one IP address of the DU (250) of the IAB node (200) may be allocated by the OAM server, or by the CU (150) of the IAB host node (100), or by the DU (160) of the IAB host node (100) during phase 1 or phase 2. In other words, the IP address allocation process may occur at any time after the RRC connection is established. In the case of IAB host-based IP address allocation, at least one IP address is allocated by the IAB host CU (150) or the IAB host DU (160). In both cases, the IAB node (200) requests at least one IP address from the IAB host CU (150) via RRC. The IAB node (200) includes a separate IP address request for each usage, where the defined usages are all traffic, F1-U, F1-C, and non-F1. The IAB host CU (150) may initiate an IAB transport network layer (TNL) address allocation process to obtain an IP address from the IAB host DU (160). The IAB host CU (150) sends the IP address allocated for each purpose to the IAB node (200) via RRC.

[0087] In case of OAM-based IP address allocation, the IAB node (200) notifies the IAB host CU (150) of at least one IP address of the IAB node (200) received for each purpose via a UL RRC message, and the IAB host CU (150) stores the at least one IP address.

[0088] At 412, the IAB host (100) stores the at least one IP address assigned / notified of the DU (250) of the IAB node (200) in the context of the IAB node (200) (ie, UE context). In addition, a backhaul RLC channel establishment and routing update procedure is performed.

[0089] At 414, as part of the Phase 3 process (IAB-DU (250) setup), the IAB node (200) (the DU function of the IAB node) initiates an F1* connection (e.g., F1*-C) with the CU (150) of the IAB host node (100) by sending an F1 setup message to the IAB host node (100). The IAB node (200) includes the assigned / notified IP address (e.g., as part of the (outer) IP header of the request message (the source IP address of the IAB-DU (for F1-C purposes))) with the F1 setup message to the IAB host node (100) (i.e., the IAB host CU (150)).

[0090] At 416, further as part of the Phase 3 process (IAB-DU (250) establishment), the IAB node context is identified at the IAB host node (100) using the assigned / notified IP address (for F1-C purposes), and the IAB host node (100) may check whether the stored IAB authorization information in the IAB node context (i.e., UE context) is "Authorized".

[0091] At 418, further as part of the Phase 3 process (IAB-DU (250) establishment), the IAB host node (100) continues the establishment process. In order to support flexible plug-and-play of the IAB node (200) and the IAB host node (100) without pre-configuration of (multiple) PSKs, dynamic PSK calculation for IKEv2 PSK authentication may also be supported, as specified in TS 33.501 v16.3.0. When using dynamic PSK, the IAB node (200) and the IAB host node (100) shall calculate the PSK (K) as specified in TS 33.501 v16.3.0. IAB The IAB host node (100) uses the IAB node DU IP address (assigned for F1-C use) to uniquely identify the security context (K) of the IAB node. gNB ). The IAB host node (100) should use K IAB As PSK used for IKEv2 process between IAB node (200) and IAB host node (100).

[0092] Figure 5 A sequence diagram showing the use of the C-RNTI of the IAB node MT function to determine the context of the IAB node (200) to establish / set up the F1* interface with the IAB host node (100) according to the embodiments disclosed herein.

[0093] At 502, as part of the IAB-MT (240) establishment procedure (Phase 1), the IAB node (200) (i.e., acting as a UE with MT functionality (240)) performs authentication and establishes an AS security context with a normal gNB or IAB host node (100). If registered with a normal gNB / eNB, the IAB node (200) (i.e., acting as a UE with MT functionality (240)) establishes an AS security context with the IAB host node (100) using a context provided by the normal gNB / eNB as part of the handover procedure or by performing an Attach / Registration (Initial Attach) procedure or by an SgNB Addition procedure (in which case the normal gNB / eNB is a MgNB / MeNB).

[0094] At 504-506, as part of the IAB-MT (240) establishment process (Phase 1), once the IAB node (200) is successfully identified and authenticated, authorization for the connection of the IAB node (200) to the 5GC / EPS should be evaluated by the network. Authorization is performed during the IAB node registration process. The core network should authorize the IAB node (200) by subscribing to the profile. The IAB host node (100) receives the authorization from the AMF (300) / MME ( Figure 5 The IAB node (200) obtains IAB authorization information (eg, as part of the initial context establishment process (ie, the INITIAL CONTEXT SETUP REQUEST message)) (not shown).

[0095] At 508, as part of the IAB-MT (240) establishment process (Phase 1), if the authorization information is indicated as "authorized", the IAB host node (100) stores the authorization information of the IAB node (200) (i.e., received at 506) and the context of the IAB node (200) (i.e., UE context). In addition, the IAB host node (100) may allocate or reserve an IP address for the DU of the IAB node (200).

[0096] At 510, as part of the Phase 2 process, a backhaul RLC channel establishment and routing update process is performed.

[0097] At 512, as part of the phase 3 process (IAB-DU (250) setup), the IAB node (200) (i.e., the DU function of the IAB node (200)) initiates an F1* connection (e.g., F1*-C) with the CU (150) of the IAB host node (100) by sending an F1 setup message to the IAB host node (100). The IAB node (200) includes the C-RNTI (i.e., the C-RNTI assigned to the UE (240) function in the IAB node (200) during phase 1 (IAB-MT (240) setup process)) in the F1 setup message to the CU (150) of the IAB host node (100).

[0098] At 514, as part of the Phase 3 process (IAB-DU (250) establishment), the C-RNTI is used at the IAB host node (100) to identify the context of the IAB node (200), and the IAB host node (100) may check whether the stored IAB authorization information in the IAB node context (i.e., UE context) (i.e., the context of the IAB node (200)) is "authorized".

[0099] At 516, as part of the Phase 3 process (IAB-DU (250) establishment), the IAB host node (100) continues the establishment process. In order to support flexible plug-and-play of the IAB node (200) and the IAB host node (100) without pre-configuration of (multiple) PSKs, dynamic PSK calculation for IKEv2 PSK authentication may also be supported, as specified in TS 33.501 v16.3.0. When using dynamic PSK, the IAB node (200) and the IAB host node (100) shall calculate the PSK (K) as specified in TS 33.501 v16.3.0. IAB The IAB host node (100) uses the C-RNTI to uniquely identify the security context (K gNB ). The IAB host node (100) should use K IAB As PSK used for IKEv2 process between IAB node (200) and IAB host node (100).

[0100] Figure 6 A sequence diagram showing the use of the GUTI of the MT function of the IAB node (ie, the IAB node (200)) to determine the context of the IAB node (200) to establish / set up the F1* interface with the IAB host node (100) according to an embodiment disclosed herein.

[0101] At 602, as part of the IAB-MT (240) establishment procedure (Phase 1), the IAB node (200) (i.e., acting as a UE with MT functionality (240)) performs authentication and establishes an AS security context with either a normal gNB / eNB or an IAB host node (100). If registered with a normal gNB / eNB, the IAB node (200) (i.e., acting as a UE with MT functionality (240)) establishes an AS security context with the IAB host node (100) using a context provided by the normal gNB / eNB as part of a handover procedure or by performing an attach / registration (initial attach) procedure or by an SgNB add procedure (in which case the normal gNB / eNB is a MgNB / MeNB).

[0102] At 604-606, as part of the IAB-MT (240) establishment process (Phase 1), once the IAB node (200) is successfully identified and authenticated, authorization for the connection of the IAB node (200) to the 5GC / EPS shall be evaluated by the network. Authorization is performed during the IAB node registration process. The core network shall authorize the IAB node (200) by subscribing to the profile. The IAB host node (100) receives the authorization from the AMF (200) / MME ( Figure 6The AMF (300) / MME obtains the IAB authorization information of the IAB node (200) (e.g., as part of the initial context establishment process (INITIAL CONTEXT SETUP REQUEST message)). In case of a successful registration process, the AMF (300) / MME allocates the GUTI to the IAB node (200) (i.e., the MT function).

[0103] At 608-610, as part of the IAB-MT (240) establishment process (Phase 1), if the authorization information is indicated as "authorized", the IAB host node (100) stores the authorization information of the IAB node (200) (i.e., received at 606) and the context of the IAB node (200) (i.e., UE context). In addition, in the case of a successful registration process, the AMF (300) / MME ( Figure 6 The IAB host node (100) allocates the GUTI to the IAB node (200) (i.e., MT function), and the IAB host node (100) forwards the GUTI to the IAB node (200). When the GUTI is to be sent or after being sent to the IAB node (200), the IAB host node (100) stores the allocated GUTI in the context of the IAB node (200) (i.e., UE context).

[0104] At 612, as part of the Phase 2 process, the IP address of the DU (250) assigned to the IAB node (200) may be sent to the IAB node (200) if requested by the IAB node (200).

[0105] At 614, as part of the phase 3 process (IAB-DU (250) setup), the IAB node (200) (i.e., the DU function of the IAB node (200)) initiates an F1* connection (e.g., F1*-C) with the CU (150) of the IAB host node (100) by sending an F1 setup message to the IAB host node (100). The IAB node (200) includes the GUTI (i.e., the GUTI assigned to the UE (240) with MT function in the IAB node (200) during phase 1 (IAB-MT (240) setup process)) in the F1 setup message to the CU (150) of the IAB host node (100).

[0106] At 616, as part of the Phase 3 process (IAB-DU (250) establishment), the GUTI is used at the IAB host node (100) to identify the context of the IAB node (200), and the IAB host node (100) may check whether the stored IAB authorization information in the context of the IAB node (200) (i.e., context) is "authorized".

[0107] At 618, as part of the Phase 3 process (IAB-DU (250) partial establishment), the IAB host node (100) continues the establishment process. In order to support flexible plug-and-play of the IAB node (200) and the IAB host node (100) without pre-configuration of (multiple) PSKs, dynamic PSK calculation for IKEv2 PSK authentication may also be supported, as specified in TS 33.501 v16.3.0. When using dynamic PSK, the IAB node (200) and the IAB host node (100) shall calculate the PSK (K) as specified in TS 33.501 v16.3.0. IAB The IAB host node (100) uses the GUTI to uniquely identify the security context (K gNB ). The IAB host node (100) should use K IAB As PSK used for IKEv2 process between IAB node (200) and IAB host node (100).

[0108] Figure 7 A sequence diagram is shown for determining the context of the IAB Node (200) using the IAB Node-DU ID to establish / set up the F1* interface with the IAB Host Node (100) according to embodiments disclosed herein.

[0109] At 702-704, as part of the IAB-MT (240) establishment process (stage 1), the IAB node (200) (i.e., acting as a UE (240) with MT functionality) performs an RRC connection establishment process. During the RRC connection establishment process, the IAB node (200) provides the IAB node-DU ID (i.e., the gNB-DU ID of the IAB node) to the IAB host node (100) (i.e., the IAB host CU (150)). In an embodiment, the IAB node (200) provides the IAB node-DU ID in at least one of the RRC messages (e.g., RRC establishment complete, RRC establishment request, and new RRC message). The gNB-DU ID / IAB node-DU ID is configured at the IAB node-DU ID and is used to uniquely identify the IAB node-DU ID at least within the CU (150) of the IAB host node (100). Upon receiving the IAB Node-DU ID from the IAB Node (200), the IAB Host Node (100) stores the IAB Node-DU ID of the IAB Node (200) and the context of the IAB Node (200) (ie, UE context).

[0110] At 706, as part of the IAB-MT (240) establishment procedure (Phase 1), the IAB node (200) (i.e., acting as a UE with MT functionality (240)) performs authentication and establishes an AS security context with a normal gNB or IAB host node (100). If registered with a normal gNB / eNB, the IAB node (200) (i.e., acting as a UE with MT functionality (240)) establishes an AS security context with the IAB host node (100) using a context provided by the normal gNB / eNB as part of the handover procedure or by performing an Attach / Registration (i.e., Initial Attach) procedure or through an SgNB Addition procedure (the normal gNB / eNB is a MgNB / MeNB).

[0111] At 708-710, as part of the IAB-MT (240) establishment process (Phase 1), once the IAB node (200) is successfully identified and authenticated, authorization for the connection of the IAB node (200) to the 5GC / EPS shall be evaluated by the network. Authorization is performed during the IAB node registration process. The core network shall authorize the IAB node (200) by subscribing to the profile. The IAB host node (100) receives the authorization from the AMF (300) / MME ( Figure 7 (not shown) obtains the IAB authorization information of the IAB node (200) (eg, as part of the initial context establishment process (INITIAL CONTEXT SETUP REQUEST message)).

[0112] At 712, as part of the IAB-MT (240) establishment process (Phase 1), if the authorization information is indicated as "authorized", the IAB host node (100) stores the authorization information of the IAB node (200) (i.e., received at 710) and the context of the IAB node (200) (i.e., UE context). Then, as part of the Phase 2 process, the backhaul RLC channel establishment and routing update process is performed.

[0113] At 714, as part of the Phase 3 process (IAB-DU (250) setup), the IAB node (200) (i.e., the DU function of the IAB node (200)) initiates an F1* connection (e.g., F1*-C) with the CU (150) of the IAB host node (100) by sending an F1 setup message to the CU (150) of the IAB host node (100). The IAB node (200) includes the IAB node-DU ID in the F1 setup message to the CU (150) of the IAB host node (100).

[0114] At 716, as part of the Phase 3 process (IAB-DU (250) establishment), the IAB Node-DU ID is used at the IAB host node (100) to identify the context of the IAB node (200), and the IAB host node (100) may check whether the stored IAB authorization information in the context of the IAB node (200) (i.e., the UE context) is "authorized".

[0115] At 718, as part of the Phase 3 process (IAB-DU (250) establishment), the IAB host node (100) continues the establishment process. In order to support flexible plug-and-play of the IAB node (200) and the IAB host node (100) without pre-configuration of (multiple) PSKs, dynamic PSK calculation for IKEv2 PSK authentication may also be supported, as specified in TS 33.501 v16.3.0. When using dynamic PSK, the IAB node (200) and the IAB host node (100) shall calculate the PSK (K) as specified in TS 33.501 v16.3.0. IAB The IAB host node (100) uses the IAB node-DU ID to uniquely identify the security context of the IAB node (K gNB ). The IAB host node (100) should use K IAB As PSK used for IKEv2 process between IAB node (200) and IAB host node (100).

[0116] Figure 8 A sequence diagram is shown of using an IAB node context ID to determine the context of an IAB node (200) to establish / set up an F1* interface with an IAB host node (100) according to an embodiment disclosed herein.

[0117] At 802-804, as part of the IAB-MT (240) establishment process (stage 1), the IAB node (200) (i.e., acting as a UE (240) with MT functionality) performs an RRC connection establishment process. During the RRC connection establishment process, the IAB node (200) is provided with an IAB node context ID by the IAB host node (100) (i.e., the IAB host CU (150)). In an embodiment, the IAB host node (100) provides the IAB node context ID in at least one of the RRC messages (e.g., RRC setup and new RRC messages). The IAB host node (100) stores the IAB node-DU ID of the IAB node (200) and the context of the IAB node (200) (i.e., UE context).

[0118] At 806, as part of the IAB-MT (240) establishment procedure (Phase 1), the IAB node (200) (i.e., acting as a UE with MT functionality (240)) performs authentication and establishes an AS security context with a normal gNB or IAB host node (100). If registered with a normal gNB / eNB, the IAB node (200) (i.e., acting as a UE with MT functionality (240)) establishes an AS security context with the IAB host node (100) using a context provided by the normal gNB / eNB as part of the handover procedure or by performing an Attach / Registration (Initial Attach) procedure or by an SgNB Addition procedure (normal gNB / eNB is a MgNB / MeNB).

[0119] At 808-810, as part of the IAB-MT (240) establishment process (Phase 1), once the IAB node (200) is successfully identified and authenticated, authorization for the connection of the IAB node (200) to the 5GC / EPS shall be evaluated by the network. Authorization is performed during the IAB node registration process. The core network shall authorize the IAB node (200) by subscribing to the profile. The IAB host node (100) receives the authorization from the AMF (200) / MME ( Figure 8 The IAB node (200) obtains IAB authorization information (eg, as part of the initial context establishment process (ie, the INITIAL CONTEXT SETUP REQUEST message)) (not shown).

[0120] At 812, as part of the IAB-MT (240) establishment process (Phase 1), if the authorization information is indicated as "Authorized", the IAB host node (100) stores the authorization information of the IAB node (200) (i.e., received at 810) and the context of the IAB node (200) (i.e., UE context). Then, as part of the Phase 2 process, a backhaul RLC channel establishment and routing update process is performed.

[0121] At 814, as part of the Phase 3 process (IAB-DU (250) setup), the IAB node (200) (i.e., the DU function of the IAB node (200)) initiates an F1* connection (e.g., F1*-C) with the CU (150) of the IAB host node (100) by sending an F1 setup message to the CU (150) of the IAB host node (100). The IAB node (200) includes the IAB node context ID in the F1 setup message to the CU (150) of the IAB host node (100).

[0122] In an embodiment, the I-RNTI is allocated by the IAB host node (100) in an RRC release (RRCRelease) message with a suspend configuration (suspendConfig) (the gNB should allocate a refreshed I-RNTI when the IAB node (200) transitions to RRC_INACTIVE). As part of the phase 3 process (i.e., IAB-DU (250) partial establishment), the IAB node (200) (i.e., the DU function of the IAB node (200)) initiates an F1* connection (e.g., F1*-C) with the CU (150) of the IAB host node (100) by sending an F1 setup message to the CU (150) of the IAB host node (100). The IAB node (200) includes the I-RNTI in the F1 setup message to the CU (150) of the IAB host node (100).

[0123] At 816, as part of the Phase 3 process, the IAB node context is identified at the IAB host node (100) using the IAB node context ID or I-RNTI, and the IAB host node (100) checks whether the stored IAB authorization information in the IAB node context (i.e., UE context) is "Authorized".

[0124] At 818, as part of the Phase 3 process (IAB-DU (250) establishment), the IAB host node (100) continues the establishment process. In order to support flexible plug-and-play of the IAB node (200) and the IAB host node (100) without pre-configuration of (multiple) PSKs, dynamic PSK calculation for IKEv2 PSK authentication may also be supported, as specified in TS 33.501 v16.3.0. When using dynamic PSK, the IAB node (200) and the IAB host node (100) shall calculate the PSK (K) as specified in TS 33.501 v16.3.0. IAB The IAB host node (100) uses the IAB node context ID or I-RNTI to uniquely identify the security context (K) of the IAB node. gNB ). The IAB host node (100) should use K IAB As PSK used for IKEv2 process between IAB node (200) and IAB host node (100).

[0125] In an embodiment, depending on the deployment scenario, RRC (MT function) and F1 (DU function) may have an internal / proprietary interface. The MT and DU in the IAB node (200) are logically separated and may also be physically separated. Also in the IAB host CU (150) (i.e., the CU of the IAB host node (100)), the RRC covering the MT and the F1 covering the DU may be logically separated and may also be physically separated. In this case, the MT function (RRC) provides the necessary parameters (e.g., PSK, authorization information, etc.) to the DU function by using an internal / proprietary interface or through a standardized interface. Alternatively, if the DU / F1 function is not available in the IAB node (200), the DU / F1 sends a request to the MT / RRC including the necessary information (e.g., C-RNTI or the IP address of the IAB node DU (F1-C)) to obtain the necessary parameters (e.g., PSK, authorization information, etc.).

[0126] In an embodiment, an IP address and / or a fully qualified domain name (FQDN) is used to identify the DU function, and a mapping between an identity of the MT function (e.g., C-RNTI / IAB node ID) and an identity of the DU function (e.g., IAB node ID / IP address) is maintained in an IAB host node (100) of an IAB node (e.g., IAB node (200)), so that the IAB host node (100) can retrieve a corresponding UE context (i.e., authorization information in the UE context).

[0127] In an embodiment, for the DU function (F1) to obtain authorization during the IAB-DU (250) establishment, the MT provides the necessary information (e.g., PSK, authorization information, etc.) to the DU function in the IAB node (200) if it is not available to the DU. The necessary information is provided by using an internal / proprietary interface or by a standardized interface.

[0128] In an embodiment, a unique identifier / parameter assigned to the IAB node (200) during the IAB-MT (240) establishment and / or backhaul RLC channel establishment and / or routing update phase is stored in the UE context, which is used to identify the context during the IAB-DU (250) partial establishment for authorization check, which is selected based on the RRC state of the MT function of the IAB node. For illustration purposes, if the RRC state of the MT function of the IAB node (200) is RRC_INACTIVE, the I-RNTI and / or the DU IP address of the IAB node (200) is used, and if the RRC state of the MT function of the IAB node (200) is RRC_Connected, the GUTI and / or the DU IP address of the IAB node (200) is used.

[0129] In an embodiment, during the phase 3 (IAB DU partial setup) procedure, if the IAB node (200) (i.e., acting as a UE (240) with MT function) is in RRC idle state, then the IAB node (200) transitions to RRC_Connected (triggered by itself or by the IAB host node), and then performs the phase 3 (IAB DU partial setup) procedure so that the IAB host node (100) performs an authorization check on the IAB node (200).

[0130] In an embodiment, during the Phase 3 (IAB DU Partial Setup) process, before performing the authentication process to establish the F1 interface, an authorization check is performed by the IAB Host Node (100) by retrieving the UE context using the identity provided as part of the F1 Setup Request message. In an embodiment, some deployments use the BAP address of the IAB Node (F1-C) instead of the IAB-DU IP address to identify the AS security context.

[0131] In an embodiment, during the Phase 3 (IAB DU Partial Establishment) process, the IAB node (200) includes the IP address of its DU F1-C Usage IP address as the IKEv2 Identity-Originator (IDi) payload value, and the IAB host node (100) uses the IKEv2 Identity-Originator (IDi) payload value to uniquely identify the security context (IKEv2) of the IAB node. gNB ). The IAB host node (100) should use K IAB As PSK used for IKEv2 process between IAB node (200) and IAB host node (100).

[0132] The embodiments disclosed herein may be implemented using at least one software program running on at least one hardware device and performing network management functions to control the elements.

[0133] Although the present disclosure has been described with various embodiments, various changes and modifications may be suggested to one skilled in the art. The present disclosure is intended to encompass such changes and modifications as fall within the scope of the appended claims.

Claims

1. A method for authentication of an IAB node performed by an integrated access backhaul (IAB) host node, the method comprising: During the context establishment process, obtaining IAB authorization information of the IAB node; Sending, to the IAB node, a parameter for identifying security context information of the IAB node; identifying security context information of the IAB node based on the parameter; generating security parameters based on the security context information of the IAB node; as well as establishing an Internet Protocol security (IPsec) connection with the IAB node based on the security parameters, The parameters include an Internet Protocol (IP) address of a distribution unit (DU) of the IAB node, and The security parameter is used as a pre-shared key PSK for Internet Key Exchange IKEv2 authentication.

2. The method according to claim 1, in, The IAB authorization information of the IAB node is obtained from the core network based on the subscription data of the IAB node.

3. The method according to claim 1, in, The IP address of the DU of the IAB node is allocated by the centralized unit CU of the IAB host node or the DU of the IAB host node or an operation and management OAM server.

4. The method according to claim 1, in, The security context information identifying the IAB node includes: identifying security context information of the IAB node based on at least one of the following: Cell Radio Network Temporary Identifier C-RNTI; The globally unique temporary ID GUTI of the IAB node; IAB node DU ID; or IAB node context ID.

5. The method according to claim 1, in, The security context information of the IAB node includes an access layer AS security context established with the IAB host node.

6. A method performed by an integrated access backhaul (IAB) node for authentication of an IAB node, the method comprising: Execute IAB-mobile terminal MT establishment process; After performing the IAB-MT establishment process, requesting from the IAB host node parameters for identifying the security context information of the IAB node; receiving the parameter from the IAB host node; Sending an F1 setup message to the IAB host node; as well as establishing an Internet Protocol security (IPsec) connection with the IAB host node based on security parameters generated by the IAB host node, wherein the security context information of the IAB node is identified by the IAB host node based on the parameter, The parameters include an Internet Protocol (IP) address of a distribution unit (DU) of the IAB node, and The security parameter is used as a pre-shared key PSK for Internet Key Exchange IKEv2 authentication.

7. The method according to claim 6, in, The IAB-MT establishment process includes at least one of the following: performing a radio resource control (RRC) connection establishment with the IAB host node; Perform authentication with the core network; or Performing establishment of an access layer AS context with the IAB host node.

8. The method according to claim 6, in, The F1 setup message includes at least one of the following: The IP address of the DU of the IAB node; or IAB node DU ID.

9. A device for an integrated access backhaul IAB host node, the device comprising: Memory; communicator; and A processor coupled to the memory and the communicator, configured to: During the context establishment process, obtain the IAB authorization information of the IAB node, sending, to the IAB node, a parameter for identifying security context information of the IAB node, identifying security context information of the IAB node based on the parameter, generating security parameters based on the security context information of the IAB node, and establishing an Internet Protocol security (IPsec) connection with the IAB node based on the security parameters, The parameters include an Internet Protocol (IP) address of a distribution unit (DU) of the IAB node, and The security parameter is used as a pre-shared key PSK for Internet Key Exchange IKEv2 authentication.

10. The device according to claim 9, in, The IAB authorization information of the IAB node is obtained from the core network based on the subscription data of the IAB node.

11. The device according to claim 9, in, The IP address of the DU of the IAB node is allocated by the centralized unit CU of the IAB host node or the DU of the IAB host node or an operation and management OAM server.

12. The device according to claim 9, in, The security context information identifying the IAB node includes: identifying security context information of the IAB node based on at least one of the following: Cell Radio Network Temporary Identifier C-RNTI; The globally unique temporary ID GUTI of the IAB node; IAB node DU ID; or IAB node context ID.

13. The device according to claim 9, in, The security context information of the IAB node includes an access layer AS security context established with the IAB host node.

14. A device for integrating an access backhaul IAB node, the device comprising: Memory; communicator; and A processor coupled to the memory and the communicator, configured to: Execute IAB-mobile terminal MT establishment process, After performing the IAB-MT establishment process, requesting the IAB host node for parameters for identifying the security context information of the IAB node, receiving the parameter from the IAB host node, Sending an F1 setup message to the IAB host node, and establishing an Internet Protocol security (IPsec) connection with the IAB host node based on security parameters generated by the IAB host node, wherein the security context information of the IAB node is identified by the IAB host node based on the parameter, The parameters include an Internet Protocol (IP) address of a distribution unit (DU) of the IAB node, and The security parameter is used as a pre-shared key PSK for Internet Key Exchange IKEv2 authentication.

15. The device according to claim 14, in, The IAB-MT establishment process includes at least one of the following: performing a radio resource control (RRC) connection establishment with the IAB host node; Perform authentication with the core network; or Performing establishment of an access layer AS context with the IAB host node.

16. The device according to claim 14, in, The F1 setup message includes at least one of the following: The IP address of the DU of the IAB node; or IAB node DU ID.

Images